Three South Korean financial companies disclosed cyber incidents on Oct. 28, adding to concerns about a growing number of attacks targeting the country's financial sector.
Daishin Securities confirmed that personal and financial information belonging to 38,490 customers had been exposed. Mirae Asset Global Investments separately reported unauthorized access to internal systems, while cryptocurrency exchange Bithumb is investigating a breach involving an internal mobile system.
The incidents have not been linked to a common attacker, and the extent of customer exposure at Mirae Asset and Bithumb remains uncertain. However, the disclosures raise fresh questions about how financial institutions protect customer information across their interconnected systems.
Daishin Securities confirms 38,490 customers affected
The brokerage detected suspicious access to a server linked to remote account openings on Oct. 17. After examining roughly 60,000 suspicious requests over 10 days, it confirmed the leak on Oct. 26 and reported the incident to regulators.
The exposed information included names, email addresses, residential addresses, bank names, account numbers, and mobile phone numbers. Daishin said it encrypted account numbers and mobile phone numbers and found no evidence of unauthorized access to core operational systems or secondary damage at the time of disclosure.
The company said it would notify affected customers individually and compensate those who suffer losses in accordance with the law. It also plans to strengthen access controls and improve systems that detect and block suspicious activity.
Mirae Asset and Bithumb investigate breaches
Mirae Asset Global Investments also reported unauthorized access to internal systems. According to The Korea Times, the asset manager said internal data had been exposed but that no personal or credit information belonging to general customers was compromised.
Financial authorities have begun investigating the incident. Cryptocurrency exchange Bithumb, meanwhile, reported a breach involving its internal mobile system. The company is investigating whether customer membership information was exposed, leaving the extent of the incident unclear.
The three disclosures do not establish that the companies were targeted by the same attackers.
A wider problem for financial security
The incidents follow a wave of attacks affecting South Korean financial institutions. The Financial Services Commission reported earlier in October that 16 firms had experienced breaches involving about 100,000 cases of leaked data. BigGo Finance subsequently reported that the number of affected companies had risen to at least 20.
Security weaknesses also extend beyond confirmed breaches. A regulatory review of 555 financial companies found that 130, or 23.4%, reported shortcomings in their security management, according to BigGo Finance.
Those findings do not mean all 130 suffered cyberattacks, but they point to gaps that could leave institutions vulnerable.
The Seoul Economic Daily reported that experts have called for stronger security oversight, better information sharing and automated defenses against increasingly frequent attacks. South Korea's proposed Digital Finance Safety Act, which would strengthen security responsibilities and oversight, remains stalled.
Why supporting systems remain a security risk
Daishin's breach illustrates how systems supporting routine services, such as opening investment accounts, can become entry points for attackers seeking sensitive information.
Financial institutions rely on interconnected platforms to serve customers and work with external partners. That connectivity creates operational efficiencies but also expands the number of systems that must be secured.
A vulnerable supporting server can expose information even when core banking or investment systems remain untouched.
For financial firms, security reviews need to cover external-facing applications, account-opening systems and third-party connections, not just the infrastructure holding money directly.
The incidents also reinforce the need for rapid detection and coordinated threat intelligence sharing, particularly when attackers can repeatedly probe systems for weaknesses.
What affected customers should do
Daishin Securities customers should pay attention to breach notifications and check which information was exposed. Bithumb users and Mirae Asset customers should monitor official company updates as investigations clarify the scope of their respective incidents.
Exposed names, phone numbers, and email addresses can help criminals craft convincing phishing messages, impersonate financial institutions, or solicit account credentials. Even when account numbers are encrypted, exposed personal details can make targeted scams more credible.
Customers should avoid clicking unexpected links in messages claiming to come from their financial provider. Instead, they should use official apps or websites to verify alerts, never disclose passwords or one-time verification codes, and report suspicious account activity promptly.
For South Korea's financial sector, the immediate priority is establishing the full extent of the incidents. The longer-term challenge is strengthening security across customer-facing and internal systems before more personal information is exposed.
Other news: The US Federal Election Commission (FEC) took its electronic filing system offline following a reported hacking attempt, disrupting campaign finance disclosures just days before the November 3 midterm elections.